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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

!)□ Responsive to communication(s) filed on . 

2a)D This action is FINAL 2b)[>3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) |El Claim(s) 7-29 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) (EI Claim(s) 1-8, 10-14 and 16-28 is/are rejected. 

7) S Claim(s) 9, 15 and 29 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)KI The drawing(s) filed on 18 November 2003 is/are: a)E3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 
Claim Objections 

1. Claim 22 is objected to under 37 CFR 1 .75(c), as being of improper dependent form for 
failing to further limit the subject matter of a previous claim. Applicant is required to cancel the 
claim(s). or amend the claim(s) to place the claim(s) in proper dependent form, or rewrite the 
claim(s) in independent form. Claim 22 does not include claim limitations that further limit claim 
19. ' 

Claim Rejections - 35 USC § 101 

2. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

3. Claims 16-29 are rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non-statutory subject matter. The claimed subject matter is directed towards a system with 
undefined means and an article of manufacture that is likewise undefined. The specification 
discloses that the claimed invention can be implemented in a software only environment (page 5, 
lines 2-5). "Functional descriptive material consists of data structures and computer programs 
which impart functionality when employed as a computer component" (MPEP 2106). When 
functional descriptive material is recorded on some computer-readable medium it becomes 
structurally and functionally interrelated to the medium and will be statutory in most cases since 
use of technology permits the function of the descriptive material to be realized. See Lowry, 32 ' 
F.3d at 1583-84, 32 USPQ2d at 1035. 

Claim Rejections - 35 USC § 103 
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4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

5. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

6. Claims 1-8, 10-14, 16-28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pham, U.S. Publication No. 2003/0097591, in view of Griffiths, U.S. Patent No. 6,014,698. 
Referring to claims 1, 16, 19, 22, Pham discloses a website verification system wherein the URL 
of a requested website is transmitted to a security system ([0045]), which meets the limitation of 
intercepting a web access request from a user, directing the request to an authentication 
computer. Pham discloses that the URL of the requested website is transmitted to the security 
system, but does not specify whether the URL includes the IP address of the website or the 
domain name of the website. Griffiths discloses using the IP address of the website in the URL 
instead of the domain name (Col. 19, lines 7-23). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to use the IP address of the requested website 
in the URL submitted to the security system in order to speed up the process by avoiding the 
need to use the Domain Name System to convert the domain name to its exact IP address as 
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taught by Griffiths (Col. 19, lines 12-20). The security system accesses a database, and checks 
the received URL against the sites in the database ([0045]). The security system verifies whether 
the requested site is directed to a virus site ([0045]). Pham discloses that if the website is 
determined not to be directed to a virus site, then the user load of the requested website is 
allowed ([0045]), which meets the limitation of directing said web access request to said target 
website if positive. However, if the website is directed to a virus site, then the user is informed 
(Figure 6) and the website load is cancelled ([0045]), which meets the limitation of receiving a 
report from said authentication computer. Pham does not specify that a notification is given to 
the user if the website is not found to be a virus site. However, it would have been obvious to one 
of ordinary skill in the art at the time the invention was made to provide a positive notification to 
the user that the website has passed the tests of the security system that way the user knows that . 
the tests actually occurred. 

Referring to claims 2, 20, Pham discloses that different types of security can be selected 
for website verification ([0029] & [0044]). Once type of security allows for the user to load the 
website while verification is occurring ([0045]), which meets the limitation of directing an 
override request to said user, and directing said web access request to said target website when 
said user exercises an override option. 

Referring to claims 3, 21 , Pham discloses that if the website is determined not to be 
directed to a virus site, then the user load of the requested website is allowed to continue 
([0045]), which meets the limitation of directed said web access request to said target website 
without input from said user. Pham does not specify that a notification is given to the user if the 
website is not found to be a virus site. However, it would have been obvious to one of ordinary 
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skill in the art at the time the invention was made to provide a positive notification to the user 
that the website has passed the. tests of the security system that way the user knows that the tests 
actually occurred. 

Referring to claims 4 5 5, 10, 11, 24, 25, Pham discloses a website verification system 
wherein the URL of a requested website is transmitted to a security system ([0045]). The security 
system accesses a database, and checks the received URL against the sites in the database 
([0045]). The security system verifies whether the requested site is directed to a virus site 
([0045]), which meets the limitation of comparing said target website with previously stored 
target websites/a list of suspect websites. Pham discloses that the URL of the requested website 
is transmitted to the security system, but does not specify whether the URL includes the IP 
address of the website or the domain name of the website. Griffiths discloses using the IP 
address of the website in the URL instead of the domain name (Col. 19, lines 7-23). It would 
have been obvious to one of ordinary skill in the art at the time the invention was made to use the 
IP address of the requested website in the URL submitted to the security system in order to speed 
up the process by avoiding the need to use the Domain Name System to convert the domain 
name to its exact IP address as taught by Griffiths (Col. 19, lines 12-20). 

Referring to claims 6, 12, 26, Pham discloses that the security system contains a web 
crawler routine that fetches web pages from the requested website to check for viruses ([0029]), 
which meets the limitation of comparing behavior of the computer of said target website with a 
criterion of acceptability. Pham discloses that the URL of the requested website is transmitted to 
the security system, but does not specify whether the URL includes the IP address of the website 
or the domain name of the website. Griffiths discloses using the IP address of the website in the 
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URL instead of the domain name (Col. 19, lines 7-23). It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to use the IP address of the requested 
website in the URL submitted to the security system in order to speed up the process by avoiding 
the need to use the Domain Name System to convert the domain name to its exact IP address as 
taught by Griffiths (Col. 19, lines 12-20). 

Referring to claims 7, 13, 27, Pham discloses that the fetched web pages are examined for 
viruses using a virus database ([0029]), which meets the limitation of comparing received data 
from said target website with corresponding stored data. 

Referring to claims 8, 14, 28, Pham discloses that the security system during its 
evaluation of the requested website will automatically download files that include program code 
that would typically be run or launched by a browser program, such as Java, Active X, or object 
code (.exe) files, and scanned for viruses ([0041]), which meets the limitation of sending 
incorrect data to said target website and comparing data received from said target website in 
response to said incorrect data with corresponding stored data because the method by which the 
security system obtains the files in question is not the convention (i.e. typical) method of 
acquisition and can be considered "incorrect". 

Referring to claim 17, Pham discloses that the user request is transmitted from the user 
system to the security system (Figure 1 & [0021] & [0044]-[0045]). Pham does not specify any 
means with the individual users system for intercepting and directing web access requests. 
However, it would have been obvious to one of ordinary skill in the art at the time the invention 
was made for the user systems described in Pham to contain means to intercept web access 
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requests and ultimately direct the web access requests to the target website so that the end user 
does not have to wait for the security system to process every single web access request. 

Referring to claim 18, Pham discloses that the user request is transmitted from the user 
system to the security system (Figure 1 & [0021] & [0044]-[0045]), which meets the limitation 
of said means for intercepting a web access request and said means for directing said vveb access 
request to said target website are located centrally in a network containing a plurality of 
workstations of individual users. 

A llomtble Subject Matter 

7. Claims 9, 15, 29 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 

The following is a statement of reasons for the indication of allowable subject matter: 
The prior art does not disclose or make obvious verification of websites by distributing a denial 
of sendee attack to the target website and measuring the websites ability to respond to the large 
amount of transaction requests based upon a threshold value. 

Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Currie, U.S. Publication No. 2003/0188194 
Wagner, U.S. Patent No. 6,085,224 
Rosenberg, U.S. Patent No. 7,1 14,177 
Thomsen, U.S. Patent No. 6,745,333 
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Lalonde, U.S. Patent No. 7,072,944 

Alagna, U.S. Publication No. 2004/0123157 
9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Benjamin E. Lanier whose telephone number is 571-272-3805. 
The examiner can normally be reached on M-Th 7:30am-5 :00pm, F 7:30am -4pm. 

[f attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




